attack-path-analysis
Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and…
Learn a reliable browser workflow by iterating on a real web task, recording strategy, and proposing a reusable skill.
$ npx -y skills add CoWork-OS/CoWork-OS --skill autobrowse --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/autobrowseContext preview
The summary Claude sees to decide when to auto-load this skill.
Learn a reliable browser workflow by iterating on a real web task, recording strategy, and proposing a reusable skill.
name: autobrowse description: "Learn a reliable browser workflow by iterating on a real web task, recording strategy, and proposing a reusable skill." version: "1.0.0" metadata: author: CoWork OS Contributors <info@coworkosapp.com>
Autobrowse turns expensive browser exploration into durable operational memory. It runs a real browser task, studies the trace and diagnostics, iterates on the strategy, then graduates the reliable path into a reviewable skill artifact.
The user should not need to provide structured fields. Treat a plain request plus an optional link as enough input. Infer the objective from the request, infer the target site from any URL/domain in the request, default to 3 iterations, and default to creating a proposal.
1. **Objective.** Restate the user-visible task and target site. Define what counts as success and what actions would be irreversible. 2. **Attempt.** Use the browser normally. Prefer visible Browser V2 tooling when interacting with pages. 3. **Diagnostics.** Use `browser_console`, `browser_network`, `browser_storage`, `browser_snapshot`, and `browser_evaluate` when available. Use `browser_trace_start` and `browser_trace_stop` as supplemental diagnostics when the runtime exposes a readable trace summary. Capture only redacted, relevant evidence. 4. **Study.** Identify stalled steps, brittle selectors, hidden APIs, unnecessary clicks, rate limits, waits, auth boundaries, and deterministic shortcuts. 5. **Strategy.** Update `strategy.md` before the next iteration. The next attempt must read it first. 6. **Iterate.** Repeat up to the requested cap. Default to 3 iterations and never exceed 5 unless the user explicitly asks. 7. **Converge.** Stop early when the task succeeds and another pass produces no material improvement. 8. **Graduate.** Write `draft-skill.md`. If safe and useful, create a `skill_proposal` so the user can approve the new skill.
A graduated skill must include:
Use `skill_proposal` with action `create` by default. Use `draft-only` when the workflow is too fragile, too sensitive, or still missing validation evidence.
An Autobrowse run is not complete until `strategy.md`, `iterations.md`, and `draft-skill.md` exist in the run directory. If proposal creation fails, record the exact failure in `iterations.md` and keep the draft skill reviewable.
Local-first personal agentic OS and everything app for coding, knowledge work, web design, automations, and artifacts.
Repo: CoWork-OS/CoWork-OS
Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and…
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide Codex Security scan. Run repeated independent repository-wide…
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository…
Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch,…
Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.
Use when the user asks for a repository-wide or scoped-path security scan.